Ask your vendor three questions

In November 2023, CISA warned that attackers were exploiting Unitronics controllers used in water and wastewater systems. Its first fix was simple: "Change all default passwords on PLCs and HMIs," and make sure the factory default password "1111" was not in use.

I believe a lot of the technical debt in a utility arrives with a purchase. The vendor decides how hard the system will be to leave, to patch and to connect, and the utility pays that interest for as long as the system runs. Three questions, asked before signing, bring that debt into view.

1. Can I export all my data in open formats today?

Data you cannot take out is data you rent. Ask for a full export of your own records in a format any other system can read, and ask to see it work in a demo, on test data, before the award.

The Alliance for Water Efficiency published a template RFP for metering systems in 2019, prepared with California Department of Water Resources funding. The resource page says the template "endeavors to be technology neutral," and makes the case for open systems in one sentence: "Standards and interoperability... can encourage competition and innovation, reduce the chances of obsolescence, and avoid limited choices that could increase costs and put utilities at risk." The template itself is sent on request, and I have not read its clauses yet.

2. How long will you support this product and its endpoints?

Every product has an end date, and the contract should name it. Microsoft ended support for Windows 10 on October 14, 2025. After that, in Microsoft's words, "technical assistance, feature updates and security updates" are no longer provided. The computers still run, without fixes.

The same thing happens in the field, with less notice. EPA's 2024 fact sheet on default passwords says these passwords are "many times" identical "among all systems from a vendor or within product lines." For older control equipment, changing them "may require support from a qualified vendor or integrator and may not always be feasible." In that case EPA says a utility should "implement and document appropriate compensating security controls." So ask how long the vendor will ship security fixes for the software, the controllers and the meter endpoints, and what happens to your equipment when that period ends.

EPA also suggests that utilities may want to require vendors to "remove all default passwords and replace them with secure, unique credentials prior to system handover." That one sentence can go straight into a contract.

Support also tends to come from one place once a system is in. In September 2021, the Los Angeles Department of Water and Power approved a sole-source agreement with Oracle, for up to $23.7 million over three years with two one-year options, to support the customer information system it launched in 2013. Ask what support costs after year five, and who else could provide it.

3. Who owns and pays for each integration?

A billing system talks to the meter data system, the GIS, the work order system and the payment portal. Each connection is a piece of software that somebody has to build, test and keep working after every upgrade. If the contract does not name that somebody, it is the utility.

The WSSC Project Cornerstone report from July 2023 shows how this goes. The investigators found that WSSC "did not have the personnel qualified to act as the SI" (systems integrator), and they quote an internal review: "[w]e became the SI." Ask for a list of every integration in scope, who builds it, who maintains it after go-live, and what each upgrade will cost to retest.

4. Security paperwork answers part of the question

Buyers already ask for security evidence, and the rules are uneven. TX-RAMP, the Texas program for cloud services, applies to "state agencies, institutions of higher education, and public community colleges." Cities and utilities are not on that list. A vendor with a SOC 2 Type II report can use it in TX-RAMP's fast track, but the report does not count as a certification by itself. In my view, city and utility buyers ask for SOC 2 anyway, because it is the evidence they recognize.

AWWA's 2019 cybersecurity guidance tells utilities to "develop standard specifications language that defines cybersecurity standards for inclusion in all procurement packages." CISA's Secure by Design pledge asks software makers to "demonstrate measurable progress towards reducing default passwords" within a year of signing. 68 companies signed it when it launched in May 2024. The pledge is voluntary and covers enterprise software only.

5. What it means for utilities

Put the three questions in the RFP and score the answers. If a vendor cannot answer them in writing, that is the answer.

Two discovery questions are worth asking your own team first:

1. Can you export all your data today, in open formats?
2. Which of your meters or endpoints face a network shutdown?

6. What it means for vendors

Vendors carry technical debt too, and in my view much of it comes from the sale. Each custom integration built for one utility becomes a private branch of the product. Each RFP item added to win one bid makes the product wider and harder to maintain. Each messy data import needs its own cleaning code. That debt shows up later as slow releases, and the buyer pays for it.

Answer these three questions in your own sales material before a buyer asks. Publish your export format, your support dates and your integration model. A buyer who has been through a hard replacement project will look for them.

7. What to watch next

1. RFP language on data ownership, export and support life. Search utility bid portals for these terms in metering, billing and SCADA solicitations.
2. CISA's pledge signers list. Watch for more water technology companies on it.
3. CISA and EPA advisories on water control systems. Each one tells you which default settings attackers are using now.

Ask the three questions before you sign. They cost nothing then.